Merge remote-tracking branch 'origin/trunk' into docs/snowflake-dml-support

Author: lukekim

website/docs/api/tls/index.md

@@ -118,3 +118,70 @@ When TLS is enabled in the runtime, the Spice CLI can be configured to connect t
 ```bash
 spice sql --tls-root-certificate-file /path/to/root.pem
 ```
+
+## Mutual TLS (mTLS)
+
+:::info Enterprise Feature
+mTLS (client certificate authentication) is included in the Enterprise distribution of Spice.ai. [Learn more](https://docs.spice.ai/docs/enterprise).
+:::
+
+mTLS extends standard TLS by requiring the client to also present a certificate during the TLS handshake. This provides cryptographic authentication of both the server and the client.
+
+### Enable mTLS via spicepod.yaml
+
+Set `client_auth_mode` to `request` or `required` and provide a CA bundle to verify client certificates:
+
+```yaml
+runtime:
+  tls:
+    enabled: true
+    certificate_file: /path/to/server.crt
+    key_file: /path/to/server.key
+    client_auth_mode: required
+    client_auth_ca_file: /path/to/client-ca.pem
+```
+
+### Enable mTLS via command line
+
+```bash
+spiced --tls-enabled true \
+  --tls-certificate-file /path/to/server.crt \
+  --tls-key-file /path/to/server.key \
+  --tls-client-auth-mode required \
+  --tls-client-auth-ca-file /path/to/client-ca.pem
+```
+
+### Client auth modes
+
+| Mode | Behavior |
+|------|----------|
+| `none` *(default)* | Standard one-way TLS. No client certificate is requested. |
+| `request` | The server requests a client certificate but accepts connections without one. Presented certificates are verified against the CA. Useful for migration or audit-only deployments. |
+| `required` | A valid client certificate is required. The Flight listener rejects no-cert connections at the TLS handshake. The HTTP listener admits no-cert connections so `/health` and `/v1/ready` remain accessible for Kubernetes probes, but all other HTTP endpoints return 401 without a verified client certificate. |
+
+### Connecting with a client certificate
+
+Use cURL with a client certificate:
+
+```bash
+curl --cacert ca.pem --cert client.crt --key client.key \
+  https://localhost:8090/v1/sql -d 'SELECT 1'
+```
+
+Use the Spice CLI with a client certificate:
+
+```bash
+spice sql --tls-root-certificate-file ./ca.pem \
+  --client-tls-certificate-file ./client.crt \
+  --client-tls-key-file ./client.key
+```
+
+### Probe and metrics access
+
+Kubernetes liveness/readiness probes (`/health`, `/v1/ready`) and the metrics endpoint (`/metrics`) are always accessible without a client certificate, even under `client_auth_mode: required`.
+
+### Client CA hot-reload
+
+When `client_auth_ca_file` is used, the CA bundle is watched for changes and reloaded atomically alongside the server certificate and key. When `client_auth_ca` (inline) is used, the CA is loaded once at startup.
+
+For a complete walkthrough, see the [mTLS Cookbook recipe](https://github.com/spiceai/cookbook/tree/trunk/mtls).

website/docs/components/data-connectors/abfs.md

@@ -86,11 +86,15 @@ The dataset name cannot be a [reserved keyword](../../reference/spicepod/keyword
 
 #### Authentication parameters
 
-The following parameters are used when authenticating with Azure. Only one of these parameters can be used at a time:
+The following authentication methods are mutually exclusive — only one can be used at a time:
 
 - `abfs_access_key`
 - `abfs_bearer_token`
-- `abfs_client_secret`
+- `abfs_sas_string`
+- Client credentials (`abfs_client_id` + `abfs_client_secret` + `abfs_tenant_id`)
+- `abfs_use_cli`
+- `abfs_msi_endpoint`
+- `abfs_federated_token_file`
 - `abfs_skip_signature`
 
 If none of these are set the connector will default to using a [managed identity](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)

website/docs/components/data-connectors/elasticsearch/index.md

@@ -138,7 +138,7 @@ TLS is enabled automatically for `https://` endpoints.
 - Nested object fields are exposed as JSON strings rather than structured columns.
 - `date` and `date_nanos` fields are preserved as strings because Elasticsearch accepts heterogeneous date formats; cast to a timestamp in SQL when numeric comparison is required.
 - `dense_vector` fields without a declared `dims` value fall back to `Utf8` and are not usable as a vector column.
-- The connector issues a single `_search` request per query. The result set is capped at 10,000 hits (the Elasticsearch `index.max_result_window` default). Queries with `LIMIT N` fetch `min(N, 10000)` rows; queries without `LIMIT` return at most 10,000 rows. For larger result sets, accelerate the dataset.
+- For queries with `LIMIT N` where N ≤ 10,000, the connector issues a single `_search` request. For larger result sets or queries without `LIMIT`, the connector automatically paginates using Point-In-Time (PIT) + `search_after`, fetching all matching documents in 10,000-hit batches.
 - Pushdown of SQL predicates to Elasticsearch query DSL is limited; complex filter expressions are evaluated locally by DataFusion after fetching results.
 
 Elasticsearch can also be configured as a [Vector Engine](../vectors/elasticsearch) for datasets sourced from other connectors (storing Spice-managed embeddings in Elasticsearch rather than querying an existing index).

website/docs/components/data-connectors/flightsql.md

@@ -40,6 +40,10 @@ The dataset name. This will be used as the table name within Spice. The dataset
 | `flightsql_username` | Optional. The username to use in the underlying Apache flight Handshake Request to authenticate to the server (see [reference](https://arrow.apache.org/docs/format/Flight.html#authentication)).                                                    |
 | `flightsql_password` | Optional. The password to use in the underlying Apache flight Handshake Request to authenticate to the server. Use the [secret replacement syntax](../secret-stores/) to load the password from a secret store, e.g. `${secrets:my_flightsql_pass}`. |
 | `flightsql_tls_ca_certificate_file` | Optional. Path to a CA certificate file (PEM format) to use for TLS verification instead of system certificates. |
+| `flightsql_tls_client_certificate_file` | Optional. Path to a PEM client certificate chain for mutual TLS (mTLS). Must be set together with `flightsql_tls_client_key_file`. Mutually exclusive with `flightsql_tls_client_certificate`. |
+| `flightsql_tls_client_key_file` | Optional. Path to the PEM private key matching `flightsql_tls_client_certificate_file`. Must be set together with `flightsql_tls_client_certificate_file`. Mutually exclusive with `flightsql_tls_client_key`. |
+| `flightsql_tls_client_certificate` | Optional. Inline PEM client certificate chain for mutual TLS (mTLS). Use the [secret replacement syntax](../secret-stores/) to load from a secret store, e.g. `${secrets:my_cert}`. Must be set together with `flightsql_tls_client_key`. Mutually exclusive with `flightsql_tls_client_certificate_file`. |
+| `flightsql_tls_client_key` | Optional. Inline PEM private key for mutual TLS (mTLS). Use the [secret replacement syntax](../secret-stores/) to load from a secret store, e.g. `${secrets:my_key}`. Must be set together with `flightsql_tls_client_certificate`. Mutually exclusive with `flightsql_tls_client_key_file`. |
 
 ## Secrets
 

website/docs/components/data-connectors/ftp.md

@@ -34,7 +34,7 @@ SELECT * FROM sales LIMIT 10;
 | --------------- | ------------------------- | ------------------------------ |
 | Default Port    | 21                        | 22                             |
 | Encryption      | None (plain text)         | SSH encryption                 |
-| Authentication  | Username/password         | Username/password or SSH keys  |
+| Authentication  | Username/password         | Username/password              |
 | Recommended Use | Internal/trusted networks | Production and public networks |
 
 :::tip[Security Recommendation]

website/docs/components/data-connectors/scylladb.md

@@ -67,14 +67,14 @@ The ScyllaDB data connector can be configured by providing the following `params
 
 | Parameter Name        | Description                                                        | Required | Default |
 | --------------------- | ------------------------------------------------------------------ | -------- | ------- |
-| `scylladb_host`       | Hostname(s) of ScyllaDB nodes. Comma-separated for multiple nodes. | Yes      | -       |
-| `scylladb_hosts`      | Alternative to `scylladb_host`. Comma-separated list of hostnames. | No       | -       |
+| `scylladb_host`       | Hostname(s) of ScyllaDB nodes. Comma-separated for multiple nodes. Either `scylladb_host` or `scylladb_hosts` must be provided. | Yes*     | -       |
+| `scylladb_hosts`      | Alternative to `scylladb_host`. Comma-separated list of hostnames. Either `scylladb_host` or `scylladb_hosts` must be provided. | Yes*     | -       |
 | `scylladb_port`       | ScyllaDB CQL native transport port.                                | No       | `9042`  |
 | `scylladb_keyspace`   | The keyspace to use for queries.                                   | Yes      | -       |
 | `scylladb_user`       | Username for authentication.                                       | No       | -       |
 | `scylladb_pass`       | Password for authentication.                                       | No       | -       |
 | `scylladb_datacenter` | Preferred datacenter for connection routing.                       | No       | -       |
-| `scylladb_ssl`        | Enable SSL/TLS for connections. Not yet implemented — the parameter is accepted but has no effect. | No       | `false` |
+| `scylladb_ssl`        | Enable SSL/TLS for connections. Not yet implemented — the parameter is accepted but has no effect. | No       | -       |
 | `connection_timeout`  | Connection timeout in milliseconds.                                | No       | `10000` |
 
 ## Types

website/docs/monitoring/index.md

@@ -14,4 +14,5 @@ Spice provides integration with monitoring systems for production deployments:
 - [Datadog](monitoring/datadog) - Enterprise monitoring and analytics
 - [Grafana & Prometheus](monitoring/grafana) - Open source metrics and visualization
 - [New Relic](monitoring/new-relic) - Observability platform with OTLP intake
+- [Spice Cloud Platform](monitoring/spice-cloud) - Centralize task history from self-hosted runtimes
 - [Zipkin](monitoring/zipkin) - Distributed tracing